CVE-2026-119565
Received Received - Intake

Mass Assignment in Plausible Analytics

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated site editors to reassign notifications by supplying a site_id parameter. Attackers can submit traffic_change_notification[site_id] set to another site's primary key via PUT /sites/:domain/traffic-change-notification/:type to receive that site's traffic alerts and visitor figures.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119565
EUVD
EUVD-2026-113830

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Plausible Plausible Analytics 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Plausible Analytics through 3.2.1 has a mass assignment vulnerability in the update_traffic_change_notification function. Authenticated site editors can exploit this by sending a site_id parameter to reassign traffic alerts and visitor figures from one site to another. The attack involves sending a PUT request to /sites/:domain/traffic-change-notification/:type with traffic_change_notification[site_id] set to another site's primary key.

Impact Analysis

If you are a site editor, an attacker with editor access could redirect traffic alerts and visitor data from your site to theirs. This could lead to data leaks, misinformation about site traffic, or unauthorized access to sensitive visitor metrics.

Compliance Impact

This vulnerability could lead to unauthorized access to visitor data, potentially violating GDPR's data protection requirements or HIPAA's privacy rules if health-related data is involved. Organizations using Plausible Analytics may face compliance risks due to potential data exposure.

Mitigation Strategies

Update Plausible Analytics to version 3.2.1 or later to address the mass assignment vulnerability. Ensure only authorized users have site editor privileges and review traffic change notification configurations for unauthorized site_id assignments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119565. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart